The following data are not subject to the GDPR and can thus be freely processed:
1. personal data from the area of private lifestyle.
“Processing of personal data by natural persons for the exercise of exclusively personal or family activities. The notions include personal data processed for leisure purposes, hobbies, vacation or entertainment purposes, for the use of social networks or as part of a private collection of addresses, birthdays or other dates, e.g. to record anniversaries.” (Ernst, in: Paal/Pauly, DSGVO, Art. 2 (2017), para. 18; Plath, in: Plath, BDSG/ DSGVO, Art. 2 DSGVO (2016), para. 13).
Processing activities that are partially or fully attributable to a professional or economic activity are therefore subject to the scope of the GDPR.
2 Manual data processing within certain limits
Manual processing is subject to the GDPR only if the processing is carried out in a file system that is divided into different groups by predetermined classification criteria, systematically managed and arranged chronologically, alphabetically or on the basis of other criteria.